diff options
| author | Kristof Provost <kp@FreeBSD.org> | 2025-12-01 21:30:56 +0000 |
|---|---|---|
| committer | Kristof Provost <kp@FreeBSD.org> | 2025-12-01 21:30:56 +0000 |
| commit | 639e65144aa71cb03b5431861803f528308760dc (patch) | |
| tree | b6dfb7be5c16ff8c62df5df8f399339e7b376be7 | |
| parent | 7a283c40188ff7b0a4bae1a47bbd9ecc17ded132 (diff) | |
pfsync: fix incorrect unlock during destroy
During pfsync_clone_destroy() we clean up pending packets. This
may involve calling pfsync_undefer() or callout_drain(). We may not
hold the bucket lock during callout_drain(), but must hold it during
pfsync_undefer().
We incorrectly always released the lock, leading to assertion failures
during cleanup if there were pending deferred packets.
MFC after: 1 week
Sponsored by: Orange Business Services
| -rw-r--r-- | sys/netpfil/pf/if_pfsync.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/sys/netpfil/pf/if_pfsync.c b/sys/netpfil/pf/if_pfsync.c index de69ecbb0985..b571734b4250 100644 --- a/sys/netpfil/pf/if_pfsync.c +++ b/sys/netpfil/pf/if_pfsync.c @@ -466,13 +466,13 @@ pfsync_clone_destroy(struct ifnet *ifp) TAILQ_FIRST(&b->b_deferrals); ret = callout_stop(&pd->pd_tmo); - PFSYNC_BUCKET_UNLOCK(b); if (ret > 0) { pfsync_undefer(pd, 1); } else { + PFSYNC_BUCKET_UNLOCK(b); callout_drain(&pd->pd_tmo); + PFSYNC_BUCKET_LOCK(b); } - PFSYNC_BUCKET_LOCK(b); } MPASS(b->b_deferred == 0); MPASS(TAILQ_EMPTY(&b->b_deferrals)); |